---
id: "MAL-2026-16099"
kind: "package"
aliases: ["MAL-2026-16099"]
title: "Malicious code in bq-sdist-probe-vrp (PyPI)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "bq-sdist-probe-vrp", "fixed": [], "affected": "= 0.0.1", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-09-09T19:01:51+00:00"
first_seen_at: "2026-10-26T20:51:57+00:00"
updated_at: "2026-10-26T21:10:31+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-16099", "first_seen_at": "2026-10-26T20:51:57+00:00"}]
---

# Malicious code in bq-sdist-probe-vrp (PyPI)

## Affected

- pypi:bq-sdist-probe-vrp affected = 0.0.1 fixed ?

## Timeline

- 2026-10-26T20:51:57+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-16099

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f61d3e118672e10f0dc02115acd8235c3b356d75e7cb59a69e26fec28070c814)
setup.py executes at pip install time and performs installer-side credential and host reconnaissance. It queries the GCE/GCP metadata service at http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token with the Metadata-Flavor: Google header to obtain the default service account's OAuth access token, service account email, and project id. It also filters os.environ for keys containing token, secret, key, pass, auth, google, project, docker, kube, or metadata substrings, and collects hostname, uid/gid/pid, the output of the id command, os.uname(), /proc/version, os.listdir('/'), and checks for /var/run/docker.sock. It performs an outbound TCP connect to 8.8.8.8:53 to test network reachability. The collected data is persisted to a JSON file inside the installed package directory. Naming (bq-sdist-probe-vrp) and behavior are consistent with a probe that harvests installer-owned cloud credentials in CI/build environments.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_